Production environments are almost always monitored using performance monitoring tools, but these systems are not sufficient to detect security incidents that compromise the integrity and confidentiality of the systems. This is because fundamentally different types of monitoring are required.
The top priority for security solutions should be to effectively log and analyse all activity in order to identify potential threats. This is particularly important as it is difficult to predict what an attacker will do next. Unlike performance analysis, where data can be aggregated and certain data records may not be captured, the search for potentially malicious activity often involves looking for a very small number of requests or instructions, such as SQL statements, which could cause a data leak or manipulation.
In the IT projects where I have worked in technical roles, our team assumed that tools such as AppDynamics would not only help with performance issues, but also with identifying attacks aimed at stealing or manipulating sensitive data. However, these attacks were never identified and the solution’s ability to detect such incidents is very limited. It could also be the case that nobody copied any customer data.
Unfortunately, I signed off on risk assessments in the belief that these performance tools were capable of monitoring data confidentiality. Furthermore, not all access to personal data was logged, and sometimes one could only see the application account, but not the actual human user.
I have learnt that performance monitoring and the monitoring of confidentiality and integrity have different requirements. It is therefore important to use separate monitoring tools to identify SQL injection attacks, credential abuse or other attacks against confidentiality in applications.
Can you identify any further differences between monitoring performance and monitoring confidentiality?